Add workspace lifecycle management via task-complete callback

- Workspaces curl POST /webhook/task-complete/{name} when done
- Orchestrator deletes the workspace via Coder API on callback
- Active workspaces count toward concurrency limit
- GET /queue now shows active workspaces with elapsed time
- Coder template gains callback_url parameter
- TTL becomes a safety net, not the primary shutdown mechanism

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/config.ts

@@ -19,6 +19,8 @@ export interface Config {
   botReviewUsername: string;
   /** Gitea base URL (e.g. https://gitea.samson.media) */
   giteaUrl: string;
+  /** Base URL for task-complete callbacks (e.g. https://sdlc.samson.media) */
+  callbackUrl: string;
   /** Optional webhook secret for verifying Gitea signatures */
   webhookSecret?: string;
 }
@@ -43,6 +45,7 @@ export function loadConfig(): Config {
     botDevUsername: process.env.BOT_DEV_USERNAME || "claude-dev",
     botReviewUsername: process.env.BOT_REVIEW_USERNAME || "claude-review",
     giteaUrl: process.env.GITEA_URL || "https://gitea.samson.media",
+    callbackUrl: required("CALLBACK_URL"),
     webhookSecret: process.env.WEBHOOK_SECRET,
   };
 }